13 files changed, 158 insertions, 136 deletions

diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
index 6126c0ab5880..4ba7b038928f 100644
--- a/drivers/net/wireless/rt2x00/rt2400pci.c
+++ b/drivers/net/wireless/rt2x00/rt2400pci.c
@@ -1007,15 +1007,15 @@ static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
-        __le32 *txd = skbdesc->desc;
+        __le32 *txd = entry_priv->desc;
         u32 word;
 
         /*
          * Start writing the descriptor words.
          */
-        rt2x00_desc_read(entry_priv->desc, 1, &word);
+        rt2x00_desc_read(txd, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, skbdesc->skb_dma);
-        rt2x00_desc_write(entry_priv->desc, 1, word);
+        rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
         rt2x00_set_field32(&word, TXD_W2_BUFFER_LENGTH, txdesc->length);
@@ -1040,6 +1040,11 @@ static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W3_PLCP_LENGTH_HIGH_BUSY, 1);
         rt2x00_desc_write(txd, 4, word);
 
+        /*
+         * Writing TXD word 0 must the last to prevent a race condition with
+         * the device, whereby the device may take hold of the TXD before we
+         * finished updating it.
+         */
         rt2x00_desc_read(txd, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
         rt2x00_set_field32(&word, TXD_W0_VALID, 1);
@@ -1055,6 +1060,12 @@ static void rt2400pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
                            test_bit(ENTRY_TXD_RETRY_MODE, &txdesc->flags));
         rt2x00_desc_write(txd, 0, word);
+
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->desc = txd;
+        skbdesc->desc_len = TXD_DESC_SIZE;
 }
 
 /*
@@ -1077,15 +1088,6 @@ static void rt2400pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        /*
-         * Replace rt2x00lib allocated descriptor with the
-         * pointer to the _real_ hardware descriptor.
-         * After that, map the beacon to DMA and update the
-         * descriptor.
-         */
-        memcpy(entry_priv->desc, skbdesc->desc, skbdesc->desc_len);
-        skbdesc->desc = entry_priv->desc;
-
         rt2x00queue_map_txskb(rt2x00dev, entry->skb);
 
         rt2x00_desc_read(entry_priv->desc, 1, &word);
diff --git a/drivers/net/wireless/rt2x00/rt2500pci.c b/drivers/net/wireless/rt2x00/rt2500pci.c
index 2e4f461406ae..89d132d4af12 100644
--- a/drivers/net/wireless/rt2x00/rt2500pci.c
+++ b/drivers/net/wireless/rt2x00/rt2500pci.c
@@ -1165,15 +1165,15 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
-        __le32 *txd = skbdesc->desc;
+        __le32 *txd = entry_priv->desc;
         u32 word;
 
         /*
          * Start writing the descriptor words.
          */
-        rt2x00_desc_read(entry_priv->desc, 1, &word);
+        rt2x00_desc_read(txd, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_BUFFER_ADDRESS, skbdesc->skb_dma);
-        rt2x00_desc_write(entry_priv->desc, 1, word);
+        rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
         rt2x00_set_field32(&word, TXD_W2_IV_OFFSET, IEEE80211_HEADER);
@@ -1194,6 +1194,11 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            test_bit(ENTRY_TXD_RTS_FRAME, &txdesc->flags));
         rt2x00_desc_write(txd, 10, word);
 
+        /*
+         * Writing TXD word 0 must the last to prevent a race condition with
+         * the device, whereby the device may take hold of the TXD before we
+         * finished updating it.
+         */
         rt2x00_desc_read(txd, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
         rt2x00_set_field32(&word, TXD_W0_VALID, 1);
@@ -1212,6 +1217,12 @@ static void rt2500pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, CIPHER_NONE);
         rt2x00_desc_write(txd, 0, word);
+
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->desc = txd;
+        skbdesc->desc_len = TXD_DESC_SIZE;
 }
 
 /*
@@ -1234,15 +1245,6 @@ static void rt2500pci_write_beacon(struct queue_entry *entry,
         rt2x00_set_field32(&reg, CSR14_BEACON_GEN, 0);
         rt2x00pci_register_write(rt2x00dev, CSR14, reg);
 
-        /*
-         * Replace rt2x00lib allocated descriptor with the
-         * pointer to the _real_ hardware descriptor.
-         * After that, map the beacon to DMA and update the
-         * descriptor.
-         */
-        memcpy(entry_priv->desc, skbdesc->desc, skbdesc->desc_len);
-        skbdesc->desc = entry_priv->desc;
-
         rt2x00queue_map_txskb(rt2x00dev, entry->skb);
 
         rt2x00_desc_read(entry_priv->desc, 1, &word);
diff --git a/drivers/net/wireless/rt2x00/rt2500usb.c b/drivers/net/wireless/rt2x00/rt2500usb.c
index e88d7033fbc9..9ae96a626e6d 100644
--- a/drivers/net/wireless/rt2x00/rt2500usb.c
+++ b/drivers/net/wireless/rt2x00/rt2500usb.c
@@ -1034,12 +1034,30 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = skbdesc->desc;
+        __le32 *txd = (__le32 *)(skb->data - TXD_DESC_SIZE);
         u32 word;
 
         /*
          * Start writing the descriptor words.
          */
+        rt2x00_desc_read(txd, 0, &word);
+        rt2x00_set_field32(&word, TXD_W0_RETRY_LIMIT, txdesc->retry_limit);
+        rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_ACK,
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_OFDM,
+                           (txdesc->rate_mode == RATE_MODE_OFDM));
+        rt2x00_set_field32(&word, TXD_W0_NEW_SEQ,
+                           test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
+        rt2x00_set_field32(&word, TXD_W0_CIPHER, !!txdesc->cipher);
+        rt2x00_set_field32(&word, TXD_W0_KEY_ID, txdesc->key_idx);
+        rt2x00_desc_write(txd, 0, word);
+
         rt2x00_desc_read(txd, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, txdesc->iv_offset);
         rt2x00_set_field32(&word, TXD_W1_AIFS, txdesc->aifs);
@@ -1059,23 +1077,11 @@ static void rt2500usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                 _rt2x00_desc_write(txd, 4, skbdesc->iv[1]);
         }
 
-        rt2x00_desc_read(txd, 0, &word);
-        rt2x00_set_field32(&word, TXD_W0_RETRY_LIMIT, txdesc->retry_limit);
-        rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_ACK,
-                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_OFDM,
-                           (txdesc->rate_mode == RATE_MODE_OFDM));
-        rt2x00_set_field32(&word, TXD_W0_NEW_SEQ,
-                           test_bit(ENTRY_TXD_FIRST_FRAGMENT, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
-        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
-        rt2x00_set_field32(&word, TXD_W0_CIPHER, !!txdesc->cipher);
-        rt2x00_set_field32(&word, TXD_W0_KEY_ID, txdesc->key_idx);
-        rt2x00_desc_write(txd, 0, word);
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->desc = txd;
+        skbdesc->desc_len = TXD_DESC_SIZE;
 }
 
 /*
@@ -1089,19 +1095,11 @@ static void rt2500usb_write_beacon(struct queue_entry *entry,
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
         struct queue_entry_priv_usb_bcn *bcn_priv = entry->priv_data;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         int pipe = usb_sndbulkpipe(usb_dev, entry->queue->usb_endpoint);
         int length;
         u16 reg, reg0;
 
         /*
-         * Add the descriptor in front of the skb.
-         */
-        skb_push(entry->skb, entry->queue->desc_size);
-        memcpy(entry->skb->data, skbdesc->desc, skbdesc->desc_len);
-        skbdesc->desc = entry->skb->data;
-
-        /*
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
@@ -1110,6 +1108,11 @@ static void rt2500usb_write_beacon(struct queue_entry *entry,
         rt2500usb_register_write(rt2x00dev, TXRX_CSR19, reg);
 
         /*
+         * Take the descriptor in front of the skb into account.
+         */
+        skb_push(entry->skb, TXD_DESC_SIZE);
+
+        /*
          * USB devices cannot blindly pass the skb->len as the
          * length of the data to usb_fill_bulk_urb. Pass the skb
          * to the driver to determine what the length should be.
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index 7d4778d66e77..b2f23272c3aa 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -633,7 +633,8 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = skbdesc->desc;
+        struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
+        __le32 *txd = entry_priv->desc;
         u32 word;
 
         /*
@@ -657,15 +658,14 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            !test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W1_BURST,
                            test_bit(ENTRY_TXD_BURST, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W1_SD_LEN0,
-                           rt2x00dev->ops->extra_tx_headroom);
+        rt2x00_set_field32(&word, TXD_W1_SD_LEN0, TXWI_DESC_SIZE);
         rt2x00_set_field32(&word, TXD_W1_LAST_SEC0, 0);
         rt2x00_set_field32(&word, TXD_W1_DMA_DONE, 0);
         rt2x00_desc_write(txd, 1, word);
 
         rt2x00_desc_read(txd, 2, &word);
         rt2x00_set_field32(&word, TXD_W2_SD_PTR1,
-                           skbdesc->skb_dma + rt2x00dev->ops->extra_tx_headroom);
+                           skbdesc->skb_dma + TXWI_DESC_SIZE);
         rt2x00_desc_write(txd, 2, word);
 
         rt2x00_desc_read(txd, 3, &word);
@@ -673,6 +673,12 @@ static void rt2800pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            !test_bit(ENTRY_TXD_ENCRYPT_IV, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W3_QSEL, 2);
         rt2x00_desc_write(txd, 3, word);
+
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->desc = txd;
+        skbdesc->desc_len = TXD_DESC_SIZE;
 }
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index 8ad0669a1b99..0f8b84b7224c 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -400,7 +400,7 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                     struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txi = skbdesc->desc;
+        __le32 *txi = (__le32 *)(skb->data - TXWI_DESC_SIZE - TXINFO_DESC_SIZE);
         u32 word;
 
         /*
@@ -422,6 +422,12 @@ static void rt2800usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXINFO_W0_USB_DMA_TX_BURST,
                            test_bit(ENTRY_TXD_BURST, &txdesc->flags));
         rt2x00_desc_write(txi, 0, word);
+
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->desc = txi;
+        skbdesc->desc_len = TXINFO_DESC_SIZE + TXWI_DESC_SIZE;
 }
 
 /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00debug.c b/drivers/net/wireless/rt2x00/rt2x00debug.c
index e2497f820d75..e9fe93fd8042 100644
--- a/drivers/net/wireless/rt2x00/rt2x00debug.c
+++ b/drivers/net/wireless/rt2x00/rt2x00debug.c
@@ -156,10 +156,11 @@ void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
                             enum rt2x00_dump_type type, struct sk_buff *skb)
 {
         struct rt2x00debug_intf *intf = rt2x00dev->debugfs_intf;
-        struct skb_frame_desc *desc = get_skb_frame_desc(skb);
+        struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
         struct sk_buff *skbcopy;
         struct rt2x00dump_hdr *dump_hdr;
         struct timeval timestamp;
+        u32 data_len;
 
         do_gettimeofday(&timestamp);
 
@@ -171,7 +172,11 @@ void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
                 return;
         }
 
-        skbcopy = alloc_skb(sizeof(*dump_hdr) + desc->desc_len + skb->len,
+        data_len = skb->len;
+        if (skbdesc->flags & SKBDESC_DESC_IN_SKB)
+                data_len -= skbdesc->desc_len;
+
+        skbcopy = alloc_skb(sizeof(*dump_hdr) + skbdesc->desc_len + data_len,
                             GFP_ATOMIC);
         if (!skbcopy) {
                 DEBUG(rt2x00dev, "Failed to copy skb for dump.\n");
@@ -181,18 +186,20 @@ void rt2x00debug_dump_frame(struct rt2x00_dev *rt2x00dev,
         dump_hdr = (struct rt2x00dump_hdr *)skb_put(skbcopy, sizeof(*dump_hdr));
         dump_hdr->version = cpu_to_le32(DUMP_HEADER_VERSION);
         dump_hdr->header_length = cpu_to_le32(sizeof(*dump_hdr));
-        dump_hdr->desc_length = cpu_to_le32(desc->desc_len);
-        dump_hdr->data_length = cpu_to_le32(skb->len);
+        dump_hdr->desc_length = cpu_to_le32(skbdesc->desc_len);
+        dump_hdr->data_length = cpu_to_le32(data_len);
         dump_hdr->chip_rt = cpu_to_le16(rt2x00dev->chip.rt);
         dump_hdr->chip_rf = cpu_to_le16(rt2x00dev->chip.rf);
         dump_hdr->chip_rev = cpu_to_le16(rt2x00dev->chip.rev);
         dump_hdr->type = cpu_to_le16(type);
-        dump_hdr->queue_index = desc->entry->queue->qid;
-        dump_hdr->entry_index = desc->entry->entry_idx;
+        dump_hdr->queue_index = skbdesc->entry->queue->qid;
+        dump_hdr->entry_index = skbdesc->entry->entry_idx;
         dump_hdr->timestamp_sec = cpu_to_le32(timestamp.tv_sec);
         dump_hdr->timestamp_usec = cpu_to_le32(timestamp.tv_usec);
 
-        memcpy(skb_put(skbcopy, desc->desc_len), desc->desc, desc->desc_len);
+        if (!(skbdesc->flags & SKBDESC_DESC_IN_SKB))
+                memcpy(skb_put(skbcopy, skbdesc->desc_len), skbdesc->desc,
+                       skbdesc->desc_len);
         memcpy(skb_put(skbcopy, skb->len), skb->data, skb->len);
 
         skb_queue_tail(&intf->frame_dump_skbqueue, skbcopy);
diff --git a/drivers/net/wireless/rt2x00/rt2x00dump.h b/drivers/net/wireless/rt2x00/rt2x00dump.h
index 727019a748e7..ed303b423e41 100644
--- a/drivers/net/wireless/rt2x00/rt2x00dump.h
+++ b/drivers/net/wireless/rt2x00/rt2x00dump.h
@@ -62,11 +62,14 @@
  *      the tx event which has either succeeded or failed. A frame
  *      with this type should also have been reported with as a
  *      %DUMP_FRAME_TX frame.
+ * @DUMP_FRAME_BEACON: This beacon frame is queued for transmission to the
+ *      hardware.
  */
 enum rt2x00_dump_type {
         DUMP_FRAME_RXDONE = 1,
         DUMP_FRAME_TX = 2,
         DUMP_FRAME_TXDONE = 3,
+        DUMP_FRAME_BEACON = 4,
 };
 
 /**
diff --git a/drivers/net/wireless/rt2x00/rt2x00pci.c b/drivers/net/wireless/rt2x00/rt2x00pci.c
index 4b941e9c794e..a016f7ccde29 100644
--- a/drivers/net/wireless/rt2x00/rt2x00pci.c
+++ b/drivers/net/wireless/rt2x00/rt2x00pci.c
@@ -67,8 +67,6 @@ int rt2x00pci_write_tx_data(struct queue_entry *entry,
                             struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
-        struct skb_frame_desc *skbdesc;
 
         /*
          * This should not happen, we already checked the entry
@@ -83,13 +81,6 @@ int rt2x00pci_write_tx_data(struct queue_entry *entry,
                 return -EINVAL;
         }
 
-        /*
-         * Fill in skb descriptor
-         */
-        skbdesc = get_skb_frame_desc(entry->skb);
-        skbdesc->desc = entry_priv->desc;
-        skbdesc->desc_len = entry->queue->desc_size;
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(rt2x00pci_write_tx_data);
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
index 089a12c7b90f..20dbdd6fb904 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
@@ -421,6 +421,7 @@ static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
 {
         struct data_queue *queue = entry->queue;
         struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
+        enum rt2x00_dump_type dump_type;
 
         rt2x00dev->ops->lib->write_tx_desc(rt2x00dev, entry->skb, txdesc);
 
@@ -428,7 +429,9 @@ static void rt2x00queue_write_tx_descriptor(struct queue_entry *entry,
          * All processing on the frame has been completed, this means
          * it is now ready to be dumped to userspace through debugfs.
          */
-        rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_TX, entry->skb);
+        dump_type = (txdesc->queue == QID_BEACON) ?
+                                        DUMP_FRAME_BEACON : DUMP_FRAME_TX;
+        rt2x00debug_dump_frame(rt2x00dev, dump_type, entry->skb);
 }
 
 static void rt2x00queue_kick_tx_queue(struct queue_entry *entry,
@@ -553,7 +556,6 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         struct rt2x00_intf *intf = vif_to_intf(vif);
         struct skb_frame_desc *skbdesc;
         struct txentry_desc txdesc;
-        __le32 desc[16];
 
         if (unlikely(!intf->beacon))
                 return -ENOBUFS;
@@ -586,19 +588,10 @@ int rt2x00queue_update_beacon(struct rt2x00_dev *rt2x00dev,
         rt2x00queue_create_tx_descriptor(intf->beacon, &txdesc);
 
         /*
-         * For the descriptor we use a local array from where the
-         * driver can move it to the correct location required for
-         * the hardware.
-         */
-        memset(desc, 0, sizeof(desc));
-
-        /*
          * Fill in skb descriptor
          */
         skbdesc = get_skb_frame_desc(intf->beacon->skb);
         memset(skbdesc, 0, sizeof(*skbdesc));
-        skbdesc->desc = desc;
-        skbdesc->desc_len = intf->beacon->queue->desc_size;
         skbdesc->entry = intf->beacon;
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.h b/drivers/net/wireless/rt2x00/rt2x00queue.h
index 36a957adc1f9..f79170849add 100644
--- a/drivers/net/wireless/rt2x00/rt2x00queue.h
+++ b/drivers/net/wireless/rt2x00/rt2x00queue.h
@@ -94,12 +94,15 @@ enum data_queue_qid {
  *      mac80211 but was stripped for processing by the driver.
  * @SKBDESC_NOT_MAC80211: Frame didn't originate from mac80211,
  *      don't try to pass it back.
+ * @SKBDESC_DESC_IN_SKB: The descriptor is at the start of the
+ *      skb, instead of in the desc field.
  */
 enum skb_frame_desc_flags {
         SKBDESC_DMA_MAPPED_RX = 1 << 0,
         SKBDESC_DMA_MAPPED_TX = 1 << 1,
         SKBDESC_IV_STRIPPED = 1 << 2,
         SKBDESC_NOT_MAC80211 = 1 << 3,
+        SKBDESC_DESC_IN_SKB = 1 << 4,
 };
 
 /**
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index da111c0c2928..bd1546ba7ad2 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -222,7 +222,6 @@ int rt2x00usb_write_tx_data(struct queue_entry *entry,
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
         struct usb_device *usb_dev = to_usb_device_intf(rt2x00dev->dev);
         struct queue_entry_priv_usb *entry_priv = entry->priv_data;
-        struct skb_frame_desc *skbdesc;
         u32 length;
 
         /*
@@ -232,13 +231,6 @@ int rt2x00usb_write_tx_data(struct queue_entry *entry,
         memset(entry->skb->data, 0, entry->queue->desc_size);
 
         /*
-         * Fill in skb descriptor
-         */
-        skbdesc = get_skb_frame_desc(entry->skb);
-        skbdesc->desc = entry->skb->data;
-        skbdesc->desc_len = entry->queue->desc_size;
-
-        /*
          * USB devices cannot blindly pass the skb->len as the
          * length of the data to usb_fill_bulk_urb. Pass the skb
          * to the driver to determine what the length should be.
diff --git a/drivers/net/wireless/rt2x00/rt61pci.c b/drivers/net/wireless/rt2x00/rt61pci.c
index 86c75b9c3f25..2e3076f67535 100644
--- a/drivers/net/wireless/rt2x00/rt61pci.c
+++ b/drivers/net/wireless/rt2x00/rt61pci.c
@@ -1764,7 +1764,8 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                   struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = skbdesc->desc;
+        struct queue_entry_priv_pci *entry_priv = skbdesc->entry->priv_data;
+        __le32 *txd = entry_priv->desc;
         u32 word;
 
         /*
@@ -1802,18 +1803,23 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
         rt2x00_desc_write(txd, 5, word);
 
-        rt2x00_desc_read(txd, 6, &word);
-        rt2x00_set_field32(&word, TXD_W6_BUFFER_PHYSICAL_ADDRESS,
-                           skbdesc->skb_dma);
-        rt2x00_desc_write(txd, 6, word);
+        if (txdesc->queue != QID_BEACON) {
+                rt2x00_desc_read(txd, 6, &word);
+                rt2x00_set_field32(&word, TXD_W6_BUFFER_PHYSICAL_ADDRESS,
+                                   skbdesc->skb_dma);
+                rt2x00_desc_write(txd, 6, word);
 
-        if (skbdesc->desc_len > TXINFO_SIZE) {
                 rt2x00_desc_read(txd, 11, &word);
                 rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0,
                                    txdesc->length);
                 rt2x00_desc_write(txd, 11, word);
         }
 
+        /*
+         * Writing TXD word 0 must the last to prevent a race condition with
+         * the device, whereby the device may take hold of the TXD before we
+         * finished updating it.
+         */
         rt2x00_desc_read(txd, 0, &word);
         rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
         rt2x00_set_field32(&word, TXD_W0_VALID, 1);
@@ -1838,6 +1844,13 @@ static void rt61pci_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                            test_bit(ENTRY_TXD_BURST, &txdesc->flags));
         rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, txdesc->cipher);
         rt2x00_desc_write(txd, 0, word);
+
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->desc = txd;
+        skbdesc->desc_len =
+                (txdesc->queue == QID_BEACON) ?  TXINFO_SIZE : TXD_DESC_SIZE;
 }
 
 /*
@@ -1847,7 +1860,7 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
                                  struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
+        struct queue_entry_priv_pci *entry_priv = entry->priv_data;
         unsigned int beacon_base;
         u32 reg;
 
@@ -1863,11 +1876,9 @@ static void rt61pci_write_beacon(struct queue_entry *entry,
          * Write entire beacon with descriptor to register.
          */
         beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
-        rt2x00pci_register_multiwrite(rt2x00dev,
-                                      beacon_base,
-                                      skbdesc->desc, skbdesc->desc_len);
-        rt2x00pci_register_multiwrite(rt2x00dev,
-                                      beacon_base + skbdesc->desc_len,
+        rt2x00pci_register_multiwrite(rt2x00dev, beacon_base,
+                                      entry_priv->desc, TXINFO_SIZE);
+        rt2x00pci_register_multiwrite(rt2x00dev, beacon_base + TXINFO_SIZE,
                                       entry->skb->data, entry->skb->len);
 
         /*
diff --git a/drivers/net/wireless/rt2x00/rt73usb.c b/drivers/net/wireless/rt2x00/rt73usb.c
index 11c130748206..e35bd19c3c5a 100644
--- a/drivers/net/wireless/rt2x00/rt73usb.c
+++ b/drivers/net/wireless/rt2x00/rt73usb.c
@@ -1441,12 +1441,38 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
                                   struct txentry_desc *txdesc)
 {
         struct skb_frame_desc *skbdesc = get_skb_frame_desc(skb);
-        __le32 *txd = skbdesc->desc;
+        __le32 *txd = (__le32 *)(skb->data - TXD_DESC_SIZE);
         u32 word;
 
         /*
          * Start writing the descriptor words.
          */
+        rt2x00_desc_read(txd, 0, &word);
+        rt2x00_set_field32(&word, TXD_W0_BURST,
+                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_VALID, 1);
+        rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
+                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_ACK,
+                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
+                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_OFDM,
+                           (txdesc->rate_mode == RATE_MODE_OFDM));
+        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
+        rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
+                           test_bit(ENTRY_TXD_RETRY_MODE, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_TKIP_MIC,
+                           test_bit(ENTRY_TXD_ENCRYPT_MMIC, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_KEY_TABLE,
+                           test_bit(ENTRY_TXD_ENCRYPT_PAIRWISE, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_KEY_INDEX, txdesc->key_idx);
+        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
+        rt2x00_set_field32(&word, TXD_W0_BURST2,
+                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
+        rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, txdesc->cipher);
+        rt2x00_desc_write(txd, 0, word);
+
         rt2x00_desc_read(txd, 1, &word);
         rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, txdesc->queue);
         rt2x00_set_field32(&word, TXD_W1_AIFSN, txdesc->aifs);
@@ -1475,31 +1501,11 @@ static void rt73usb_write_tx_desc(struct rt2x00_dev *rt2x00dev,
         rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
         rt2x00_desc_write(txd, 5, word);
 
-        rt2x00_desc_read(txd, 0, &word);
-        rt2x00_set_field32(&word, TXD_W0_BURST,
-                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_VALID, 1);
-        rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
-                           test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_ACK,
-                           test_bit(ENTRY_TXD_ACK, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
-                           test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_OFDM,
-                           (txdesc->rate_mode == RATE_MODE_OFDM));
-        rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->ifs);
-        rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
-                           test_bit(ENTRY_TXD_RETRY_MODE, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_TKIP_MIC,
-                           test_bit(ENTRY_TXD_ENCRYPT_MMIC, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_KEY_TABLE,
-                           test_bit(ENTRY_TXD_ENCRYPT_PAIRWISE, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_KEY_INDEX, txdesc->key_idx);
-        rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
-        rt2x00_set_field32(&word, TXD_W0_BURST2,
-                           test_bit(ENTRY_TXD_BURST, &txdesc->flags));
-        rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, txdesc->cipher);
-        rt2x00_desc_write(txd, 0, word);
+        /*
+         * Register descriptor details in skb frame descriptor.
+         */
+        skbdesc->desc = txd;
+        skbdesc->desc_len = TXD_DESC_SIZE;
 }
 
 /*
@@ -1509,18 +1515,10 @@ static void rt73usb_write_beacon(struct queue_entry *entry,
                                  struct txentry_desc *txdesc)
 {
         struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
-        struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
         unsigned int beacon_base;
         u32 reg;
 
         /*
-         * Add the descriptor in front of the skb.
-         */
-        skb_push(entry->skb, entry->queue->desc_size);
-        memcpy(entry->skb->data, skbdesc->desc, skbdesc->desc_len);
-        skbdesc->desc = entry->skb->data;
-
-        /*
          * Disable beaconing while we are reloading the beacon data,
          * otherwise we might be sending out invalid data.
          */
@@ -1529,6 +1527,11 @@ static void rt73usb_write_beacon(struct queue_entry *entry,
         rt2x00usb_register_write(rt2x00dev, TXRX_CSR9, reg);
 
         /*
+         * Take the descriptor in front of the skb into account.
+         */
+        skb_push(entry->skb, TXD_DESC_SIZE);
+
+        /*
          * Write entire beacon with descriptor to register.
          */
         beacon_base = HW_BEACON_OFFSET(entry->entry_idx);